Assessing Cybersecurity Readiness Among SME

Abstract

Information security is a critical issue for small and medium-sized enterprises (SMEs) around the world. These organisations face an increasing number of security incidents and the sophistication of attacks. In order to remain competitive and protect their and their customers’ critical information, it is essential that SMEs can manage their cybersecurity risks appropriately. Accordingly, it is important that these SMEs can rely on tailored information security assessments and frameworks. However, there is a scarcity of knowledge regarding their specific needs and the practical implementation of cybersecurity within these organisations. To address this knowledge gap, an exploratory study was conducted on the SME cybersecurity situation, with a particular focus on the implementation level of cybersecurity controls within SMEs in Austria and Germany. We surveyed 30 SMEs regarding their cybersecurity implementation situation in 2023. Our findings show, among other things, a very heterogeneous picture regarding the implementation level of cybersecurity controls and outline areas for action.